Sorry

The U.S. National Security Agency has repeatedly tried to compromise Tor, the government-funded online anonymity tool, but has had little success, according to a new report in the U.K.'s Guardian.

The NSA has tried multiple strategies for defeating Tor, with its most successful method focused on attacking vulnerable software on users' computers, including the Firefox browser, according to the report, published Friday. In the Firefox attack, NSA agents have been able to gain "full control" of targets' computers, said the report, citing documents given to the Guardian by former NSA contractor Edward Snowden.

NSA documents provided by Snowden, which the Guardian began publishing in June, say the agency is collecting bulk phone records in the U.S. as well as Internet communications overseas.

But in many cases, the NSA has been frustrated in its efforts to target Tor users, an irony because the open-source project is largely funded by the U.S. Department of Defense, the NSA's parent agency, and the U.S. Department of State.

"We will never be able to de-anonymize all Tor users all the time," according to one NSA document quoted by the Guardian. "With manual analysis we can de-anonymize a very small fraction of Tor users." The NSA has had "no success de-anonymizing a user in response" to a specific request, the document said.

Roger Dingledine, director of the Tor project, its "good news" for the project that the NSA attacked with a browser exploit,

That means "there's no indication they can break the Tor protocol or do traffic analysis on the Tor network," he said in an email. "Infecting the laptop, phone, or desktop is still the easiest way to learn about the human behind the keyboard."

Even with the NSA attacks, Tor can still help protect anonymity, he added. "You can target individuals with browser exploits, but if you attack too many users, somebody's going to notice," he said. "So even if the NSA aims to surveil everyone, everywhere, they have to be a lot more selective about which Tor users they spy on."

But Tor won't keep users safe in all cases, he added. "Browser exploits, large-scale surveillance, and general user security are all challenging topics for the average Internet user," he said. "These attacks make it clear that we, the broader internet community, need to keep working on better security for browsers and other Internet-facing applications."

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's email address is grant_gross@idg.com.